Provenance stamp hardcodes version 0.5.0 (package.json says 0.7.1)

by adom

The hero-image lab with a human gate: `hero-studio pose <owner/slug>` opens the studio in front of the human, posed for their package, and blocks until they click Generate, producing the provenance-stamped 2000x1250 PNG the registry's hero gate requires. The image carries the title and artwork; the exported image also bakes the type pill (top right) and full wiki slug (bottom right); the page shows the hero bare, and only the homepage marquee overlays its own dynamic info. Every hero wears its P

Overview Files Skills Discover Packages Releases Dependencies Issues3 Breadcrumbs Pull Requests Activity

Closed bug report

Colby Knox · 2mo ago ·closed by Colby Knox

Reported by AravK from tonight's publishes. hero-studio 0.7.1 stamps its PNG provenance with a hardcoded version: server.js:225 writes version: '0.5.0' into the tEXt meta JSON while package.json says 0.7.1.

No functional impact on the registry gate: the wiki validates generator === 'hero-studio' plus dimensions/weight and never reads the version field. But the stamp is the forensic record for anyone debugging the hero gate, and a stale version sends them chasing the wrong release (it cost Arav real time tonight).

Suggested fix, per Arav's local patch: read the version from package.json at stamp time, e.g. require('./package.json').version, so the stamp stays truthful across releases without a manual bump.

1 Reply

Colby Knox · 2mo ago

Fixed in 0.10.0 (live): the stamp reads version from package.json at stamp time, exactly Arav's patch, so it can never go stale again. The hardcoded 0.5.0 had survived four releases; thanks to Arav for the forensic catch and sorry for the wrong-release chase.